Description

Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch name field. The expectGitBranch() function in src/lint.ts passes the unsanitized branch name directly into child_process.exec() via an unescaped template literal, enabling arbitrary command execution when the lint command is run against the repository.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-08-28T20:19:54.027Z",
  "pubdate": "2026-08-28T20:19:54.027Z",
  "executiveSummary": "Sweater Comb versions prior to 3.8.8 are susceptible to a critical command injection vulnerability. This flaw resides in the handling of configuration parameters within the .vervet.yaml file.\nAn attacker capable of modifying or controlling the .vervet.yaml configuration can trigger arbitrary OS command execution during the linting process.\nThe vulnerability arises from the insecure processing of the branch name field within the linters.<key>.optic-ci.original configuration property. By injecting malicious input into this field, an attacker can escape the intended execution context.\nThe impact includes full control over the execution environment where the linting tool operates, potentially leading to unauthorized data access, environment manipulation, or further escalation within the development pipeline.\nExploitation requires the attacker to have write access to the repository configuration or the ability to influence the .vervet.yaml file. Given that this tool is typically used in CI/CD environments, the risk implications are severe, as successful exploitation can compromise build integrity and sensitive environment variables.",
  "technicalDetails": "The root cause of this vulnerability is the improper neutralization of special elements used in an OS command within the expectGitBranch() function located in src/lint.ts. The application utilizes a template literal to construct a command string that is subsequently passed directly to the Node.js child_process.exec() method.\nSpecifically, the linters.<key>.optic-ci.original branch name, which is retrieved from the .vervet.yaml configuration, is treated as a trusted input. Because the system fails to sanitize or validate this input for shell metacharacters (such as semicolons, backticks, or pipe operators), an attacker can terminate the intended command and append arbitrary system instructions.\nThe attack flow proceeds as follows: 1) The attacker introduces a malicious payload into the .vervet.yaml file under the linters.<key>.optic-ci.original field, such as '; [malicious_command] #'. 2) When the user or an automated CI process initiates the lint command, the application reads the tainted configuration. 3) The src/lint.ts module invokes expectGitBranch() using the malicious input. 4) The exec() function interprets the branch name as part of a shell command, executing the embedded payload with the permissions of the user running the Sweater Comb process.\nThis vulnerability is classified as Command Injection, leveraging the lack of input validation before shell execution. Since child_process.exec() spawns a shell process by default, it is inherently vulnerable if the command string contains untrusted user data. The vulnerability is present in all versions of Sweater Comb prior to 3.8.8.\nPost-exploitation, an attacker can leverage the execution context to perform reconnaissance on the build environment, exfiltrate secrets stored as environment variables, or persist malicious code within the repository. As the tool executes in the context of the repository workflow, this effectively grants the attacker the execution privileges of the CI/CD pipeline, often including access to sensitive tokens and internal network segments."
}